Subject: RE: [mobile-ip] Protecting the MN-HA signaling with IPsec

From: [email-masked]
Date: Thu, 26 Sep 2002 15:26:56 +0300

Hesham,

I thought this was the first time the details of using IPsec for MN/HA protection were documented (and according to Francis there is still some detail lacking from the document). Indeed using IPsec is easier said than done :-)

Mobility Header was introduced recently. Has there been consideration (also from the security viewpoint) of whether parts of the Mobile IPv6 spec done via ICMPv6 should be moved to the Mobility Header as well?

Mobile IPv6 spec (especially with the security solutions) is rather complex, it takes considerable time to even read the specs! Anything that would simplify it would be good.

	Jarno

> -----Original Message-----
> From: ext Hesham Soliman (EAB) [mailto:[email-masked]]
> Sent: Thursday, September 26, 2002 2:46 PM
> To: Rajahalme Jarno (NRC/Helsinki); [email-masked]
> Cc: [email-masked]; [email-masked];
> [email-masked]
> Subject: RE: [mobile-ip] Protecting the MN-HA signaling with IPsec
> 
> 
> 
>   > Preferably ALL MIPv6 features would be folded in the 
>   > Mobility Header (i.e. MPS/MPA/HAAD also in MH), and thus 
>   > protected by the same MH Authenticator.
> 
> => Do we really want to redo all this again?
> I know this is not a technical reply, but we have 
> to stop fundamental changes at some stage. This part
> has been redone 3 times.
> 
> Hesham
> 
>   > 
>   > 	Jarno
>   > 
>

---

From: Francis Dupont <[email-masked]>
Date: Thu, 26 Sep 2002 14:59:58 +0200

I thought this was the first time the details of using IPsec for
   MN/HA protection were documented (and according to Francis there is
   still some detail lacking from the document). Indeed using IPsec is
   easier said than done :-)
   
=> it is the first mobileip WG document about it but there are some years
of discussions about it. So I understand Hesham who doesn't want to
follow you on the learning curve.

   Mobility Header was introduced recently.

=> because of incompatibilities between IPsec and piggy-backing
(another hot subject).

   Mobile IPv6 spec (especially with the security solutions) is rather
  complex, it takes considerable time to even read the specs! Anything
  that would simplify it would be good.
   
=> I agree (and my proposal is more efficient: drop all the extra unsafe
or unused stuff :-).

[email-masked]